CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5172
https://notcve.org/view.php?id=CVE-2015-5172
Cloud Foundry Runtime cf-release before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to have unspecified impact by leveraging failure to expire password reset links. Cloud Foundry Runtime cf-release en versiones anteriores a la 216, UAA en versiones anteriores a la 2.5.2 y Pivotal Cloud Foundry (PCF) Elastic Runtime en versiones anteriores a la 1.7.0 permite que atacantes causen un impacto no especificado aprovechando que no caducan los enlaces de reinicio de contraseña. • https://pivotal.io/security/cve-2015-5170-5173 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-8047
https://notcve.org/view.php?id=CVE-2017-8047
In Cloud Foundry router routing-release all versions prior to v0.163.0 and cf-release all versions prior to v274, in some applications, it is possible to append a combination of characters to the URL that will allow for an open redirect. An attacker could exploit this as a phishing attack to gain access to user credentials or other sensitive data. NOTE: 274 resolves the vulnerability but has a serious bug that is fixed in 275. En todas las versiones anteriores a la 0.163.0 del desarrollo routing-release y en todas las versiones anteriores a la 274 del desarrollo cf-release de los router de Cloud Foundry, es posible añadir una combinación de caracteres en la URL que permitirá una redirección abierta. Un atacante podría explotar esta vulnerabilidad con un ataque de phishing para obtener acceso a las credenciales de usuario y otros datos sensibles. • https://www.cloudfoundry.org/cve-2017-8047 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 51EXPL: 0CVE-2016-0732
https://notcve.org/view.php?id=CVE-2016-0732
The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1.6.0 through 1.6.13 allows remote authenticated users with privileges in one zone to gain privileges and perform operations on a different zone via unspecified vectors. La característica de zonas de identidad en Pivotal Cloud Foundry 208 a 229; UAA 2.0.0 a 2.7.3 y 3.0.0; UAA-Release 2 hasta la 4, cuando se configura con múltiples zonas de identidad; y Elastic Runtime 1.6.0 hasta la 1.6.13 permite que los usuarios remotos autenticados con privilegios en una zona obtengan privilegios y realicen operaciones en una zona diferente mediante vectores no especificados. • https://pivotal.io/security/cve-2016-0732 • CWE-269: Improper Privilege Management •
CVSS: 4.7EPSS: 0%CPEs: 88EXPL: 0CVE-2016-0713
https://notcve.org/view.php?id=CVE-2016-0713
Gorouter in Cloud Foundry cf-release v141 through v228 allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks via vectors related to modified requests. Gorouter en Cloud Foundry cf-release v141 a v228 permite que los atacantes Man-in-the-Middle (MitM) realicen ataques Cross-Site Scripting (XSS) mediante vectores relacionados con peticiones modificadas. • https://bosh.io/releases/github.com/cloudfoundry/cf-release?version=229 https://lists.cloudfoundry.org/archives/list/cf-dev%40lists.cloudfoundry.org/thread/VWDLUNTDKW5CW5JWEM5BOHLJ3J32TAFF • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-8033
https://notcve.org/view.php?id=CVE-2017-8033
An issue was discovered in the Cloud Controller API in Cloud Foundry Foundation CAPI-release versions prior to v1.35.0 and cf-release versions prior to v268. A filesystem traversal vulnerability exists in the Cloud Controller that allows a space developer to escalate privileges by pushing a specially crafted application that can write arbitrary files to the Cloud Controller VM. Se ha descubierto en la API Cloud Controller en Cloud Foundry Foundation CAPI-release en versiones anteriores a 1.35.0 y las versiones cf-release anteriores a v268. Existe una vulnerabilidad de salto de sistema de archivos en Cloud Controller que permite que un desarrollador de espacio escale privilegios ejecutando una aplicación especialmente manipulada que pueda escribir archivos arbitrarios en Cloud Controller VM. • https://www.cloudfoundry.org/cve-2017-8033 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •